Gitiles
Code Review Sign In
code.v1.dodo.cloud / pcloud / 0144c13f81906eeda7290404472ae242766f3c54 / . / charts / cert-manager / templates / crd-acme.cert-manager.io_orders.yaml
blob: d64e5d6e48b293057b6b338e2810101f46ae5b34 [file] [log] [blame]
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]1{{- if or .Values.crds.enabled .Values.installCRDs }}
2apiVersion: apiextensions.k8s.io/v1
3kind: CustomResourceDefinition
4metadata:
5 name: "orders.acme.cert-manager.io"
6 {{- if .Values.crds.keep }}
7 annotations:
8 helm.sh/resource-policy: keep
9 {{- end }}
10 labels:
11 {{- include "cert-manager.crd-labels" . | nindent 4 }}
12spec:
13 group: acme.cert-manager.io
14 names:
15 categories:
16 - cert-manager
17 - cert-manager-acme
18 kind: Order
19 listKind: OrderList
20 plural: orders
21 singular: order
22 scope: Namespaced
23 versions:
24 - additionalPrinterColumns:
25 - jsonPath: .status.state
26 name: State
27 type: string
28 - jsonPath: .spec.issuerRef.name
29 name: Issuer
30 priority: 1
31 type: string
32 - jsonPath: .status.reason
33 name: Reason
34 priority: 1
35 type: string
36 - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
37 jsonPath: .metadata.creationTimestamp
38 name: Age
39 type: date
40 name: v1
41 schema:
42 openAPIV3Schema:
43 description: Order is a type to represent an Order with an ACME server
44 properties:
45 apiVersion:
46 description: |-
47 APIVersion defines the versioned schema of this representation of an object.
48 Servers should convert recognized schemas to the latest internal value, and
49 may reject unrecognized values.
50 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
51 type: string
52 kind:
53 description: |-
54 Kind is a string value representing the REST resource this object represents.
55 Servers may infer this from the endpoint the client submits requests to.
56 Cannot be updated.
57 In CamelCase.
58 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
59 type: string
60 metadata:
61 type: object
62 spec:
63 properties:
64 commonName:
65 description: |-
66 CommonName is the common name as specified on the DER encoded CSR.
67 If specified, this value must also be present in `dnsNames` or `ipAddresses`.
68 This field must match the corresponding field on the DER encoded CSR.
69 type: string
70 dnsNames:
71 description: |-
72 DNSNames is a list of DNS names that should be included as part of the Order
73 validation process.
74 This field must match the corresponding field on the DER encoded CSR.
75 items:
76 type: string
77 type: array
78 x-kubernetes-list-type: atomic
79 duration:
80 description: |-
81 Duration is the duration for the not after date for the requested certificate.
gioc895c1d2026-07-23 17:18:25 +0400[diff] [blame]82 This is set on order creation as per the ACME spec.
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]83 type: string
84 ipAddresses:
85 description: |-
86 IPAddresses is a list of IP addresses that should be included as part of the Order
87 validation process.
88 This field must match the corresponding field on the DER encoded CSR.
89 items:
90 type: string
91 type: array
92 x-kubernetes-list-type: atomic
93 issuerRef:
94 description: |-
95 IssuerRef references a properly configured ACME-type Issuer which should
96 be used to create this Order.
97 If the Issuer does not exist, processing will be retried.
98 If the Issuer is not an 'ACME' Issuer, an error will be returned and the
99 Order will be marked as failed.
100 properties:
101 group:
102 description: |-
103 Group of the issuer being referred to.
104 Defaults to 'cert-manager.io'.
105 type: string
106 kind:
107 description: |-
108 Kind of the issuer being referred to.
109 Defaults to 'Issuer'.
110 type: string
111 name:
112 description: Name of the issuer being referred to.
113 type: string
114 required:
115 - name
116 type: object
117 profile:
118 description: |-
119 Profile allows requesting a certificate profile from the ACME server.
120 Supported profiles are listed by the server's ACME directory URL.
121 type: string
gioc895c1d2026-07-23 17:18:25 +0400[diff] [blame]122 replaces:
123 description: |-
124 Replaces is the ARI CertID (RFC 9773 ยง4.1) of the certificate that this
125 Order is intended to replace. When set, cert-manager will include the
126 "replaces" field on the newOrder request to the ACME server if and only
127 if the server advertises ARI support in its directory. The CertID has
128 the form "base64url(AKI).base64url(serial)" and is derived locally from
129 the currently issued leaf certificate.
130 type: string
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]131 request:
132 description: |-
133 Certificate signing request bytes in DER encoding.
134 This will be used when finalizing the order.
135 This field must be set on the order.
136 format: byte
137 type: string
138 required:
139 - issuerRef
140 - request
141 type: object
142 status:
143 properties:
144 authorizations:
145 description: |-
146 Authorizations contains data returned from the ACME server on what
147 authorizations must be completed in order to validate the DNS names
148 specified on the Order.
149 items:
150 description: |-
151 ACMEAuthorization contains data returned from the ACME server on an
152 authorization that must be completed in order validate a DNS name on an ACME
153 Order resource.
154 properties:
155 challenges:
156 description: |-
157 Challenges specifies the challenge types offered by the ACME server.
158 One of these challenge types will be selected when validating the DNS
159 name and an appropriate Challenge resource will be created to perform
160 the ACME challenge process.
161 items:
162 description: |-
163 Challenge specifies a challenge offered by the ACME server for an Order.
164 An appropriate Challenge resource can be created to perform the ACME
165 challenge process.
166 properties:
167 token:
168 description: |-
169 Token is the token that must be presented for this challenge.
170 This is used to compute the 'key' that must also be presented.
171 type: string
172 type:
173 description: |-
174 Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
175 'tls-sni-01', etc.
176 This is the raw value retrieved from the ACME server.
177 Only 'http-01' and 'dns-01' are supported by cert-manager, other values
178 will be ignored.
179 type: string
180 url:
181 description: |-
182 URL is the URL of this challenge. It can be used to retrieve additional
183 metadata about the Challenge from the ACME server.
184 type: string
185 required:
186 - token
187 - type
188 - url
189 type: object
190 type: array
191 x-kubernetes-list-type: atomic
192 identifier:
193 description: Identifier is the DNS name to be validated as part of this authorization
194 type: string
195 initialState:
196 description: |-
197 InitialState is the initial state of the ACME authorization when first
198 fetched from the ACME server.
199 If an Authorization is already 'valid', the Order controller will not
200 create a Challenge resource for the authorization. This will occur when
201 working with an ACME server that enables 'authz reuse' (such as Let's
202 Encrypt's production endpoint).
203 If not set and 'identifier' is set, the state is assumed to be pending
204 and a Challenge will be created.
205 enum:
206 - valid
207 - ready
208 - pending
209 - processing
210 - invalid
211 - expired
212 - errored
213 type: string
214 url:
215 description: URL is the URL of the Authorization that must be completed
216 type: string
217 wildcard:
218 description: |-
219 Wildcard will be true if this authorization is for a wildcard DNS name.
220 If this is true, the identifier will be the *non-wildcard* version of
221 the DNS name.
222 For example, if '*.example.com' is the DNS name being validated, this
223 field will be 'true' and the 'identifier' field will be 'example.com'.
224 type: boolean
225 required:
226 - url
227 type: object
228 type: array
229 x-kubernetes-list-type: atomic
230 certificate:
231 description: |-
232 Certificate is a copy of the PEM encoded certificate for this Order.
233 This field will be populated after the order has been successfully
234 finalized with the ACME server, and the order has transitioned to the
235 'valid' state.
236 format: byte
237 type: string
238 failureTime:
239 description: |-
240 FailureTime stores the time that this order failed.
241 This is used to influence garbage collection and back-off.
242 format: date-time
243 type: string
244 finalizeURL:
245 description: |-
246 FinalizeURL of the Order.
247 This is used to obtain certificates for this order once it has been completed.
248 type: string
249 reason:
250 description: |-
251 Reason optionally provides more information about a why the order is in
252 the current state.
253 type: string
254 state:
255 description: |-
256 State contains the current state of this Order resource.
257 States 'success' and 'expired' are 'final'
258 enum:
259 - valid
260 - ready
261 - pending
262 - processing
263 - invalid
264 - expired
265 - errored
266 type: string
267 url:
268 description: |-
269 URL of the Order.
270 This will initially be empty when the resource is first created.
271 The Order controller will populate this field when the Order is first processed.
272 This field will be immutable after it is initially set.
273 type: string
274 type: object
275 required:
276 - metadata
277 - spec
278 type: object
gio15aa6632026-07-23 17:14:23 +0400[diff] [blame]279 selectableFields:
280 - jsonPath: .spec.issuerRef.group
281 - jsonPath: .spec.issuerRef.kind
282 - jsonPath: .spec.issuerRef.name
giod55d03a2026-07-23 16:57:48 +0400[diff] [blame]283 served: true
284 storage: true
285 subresources:
286 status: {}
287{{- end }}